US Court Verdict on NotPetya Will Tighten Policy Wording

In a surprising move, the Superior Court of New Jersey Appellate Division, recently ruled in favour of Merck’s $1.4 billion claim against the insurance industry. The claim was for damages sustained in the 2017 NotPetya cyberattack. Around 10,000 machines in its global network and over 40,000 internal machines were crippled by malware.

Claims over cyber attacks often hinge on policy wording, plus ongoing debate about rogue States, or bad actors freelancing for States, as major data breaches, or denial of service events are organised online.

Here’s an extract from the judge

ment;

“Coverage could only be excluded here if we stretched the meaning of ‘hostile’ to its outer limit in an attempt to apply it to a cyberattack on a noncombatant firm that provided accounting software updates to various noncombatant customers, all wholly outside the context of any armed conflict or military objective,” 

adding,

“But that approach would conflict with our basic construction principles requiring a court to narrowly construe an insurance policy exclusion. The specific, plain, clear, and prominent meaning of, and the clear import and intent of, a word or phrase in an exclusion does not equate to its broadest possible interpretation, but rather its narrowest.”

Monica Oravcova, COO and co-founder of Naoris Protocol, a decentralised cybersecurity solution commented;

“This is an incredible blow for the insurance industry and no doubt will precipitate a flurry of activity in existing insurance industry underwriting practices.

Lloyds of London have already paved the way in terms of dealing with the fallout of ambiguous policy language by requiring insurers to craft exclusionary clauses for “acts of war” which was the hotly debated theme of the lawsuit. The effect of the ruling will impact not only insurers but the companies that seek cover. We can expect even tighter restrictions, exclusions and possibly another spike in premiums. Now more than ever ,we need to look to decentralised technology to prevent these attacks as the costs both in terms of productivity and economics, are becoming a trillion dollar headache for business and government”.